1. Field of the Invention
The present invention relates to a fail-safe system for a vehicular computer and more particularly to a fail-safe system for a vehicular computer which controls the operation of an internal combustion engine mounted in a vehicle such as an automobile or the like.
2. Description of the Prior Art
In general, the term "fail safe" means that the entire system operates safely upon occurrence of malfunction of a device. The fail safe is indispensable to such vehicles as electric trains and automobiles in which malfunction can lead directly to a serious accident.
For example, a control system may be used to control the operation of an internal combustion engine mounted in a vehicle such as an automobile or the like, the control system including fuel injection control and ignition timing control. The electronic control system utilizes a stored-program microcomputer. In general, however, the environment of the devices mounted in an automobile is very bad and the devices are influenced by vibrations, temperatures, external noises, etc.
Particularly, the noise induced at the time of ignition of a spark plug appears on a bus, etc. as electrical noise. This may result in that, when a central processing unit (hereinafter referred to as "CPU") reads out data from a memory, the fetched instruction changes to a HALT instruction so the normal operation of the program by the computer is stopped when it should be continued. Further, if the HALT instruction is executed in an interrupt inhibit state, restart based on software becomes unfeasible and the function of the computer is lost completely. This produces a serious hindrance to the operation of the controlled system.
In order to avoid the above-mentioned inconvenience caused by malfunction, a method such as shown in FIG. 2 has heretofore been adopted. More particularly, in FIG. 2, which illustrates a system configuration of a vehicular computer, a vehicular computer unit 1 comprises a CPU 2, a memory 3 and an input/output device 4. The CPU 2, memory 3 and input/output device 4 are interconnected through buses 5, 6 and 7. The memory 3 stores a control program for controlling the operation of, for example, an internal combustion engine, as well as various data, etc. The input/output device 4 has the function of inputting data from the exterior and outputting processing results to the exterior. The CPU 2, which comprises an arithmetic processing section, a register section and a control section, performs various arithmetic operations and the execution of program.
To the CPU 2 is connected a timer 8 called "watchdog timer" for watching the operation of the CPU 2 at all times. The timer 8 exhibits the foregoing fail-safe function for resetting The CPU 2 to its normal state upon occurrence of malfunction. More specifically, a reset signal a, synchronous with the clock pulse of the CPU 2, is provided from a reset output terminal RO of the CPU to the timer 8. The timer 8 is set to count a preset time of a period longer than that of the period of the reset signal a, so while the CPU 2 is in the normal state the counting of the timer 8 is continuously reset by the reset signal a before it reads its preset count. But, upon occurrence of malfunction, the output of the reset signal a is stopped, so the timer 8 reaches the preset time and provides an initializing signal b to a reset input terminal RI of the CPU 2 to reset the CPU to the initial state.
However, such conventional method requires the additional provision of the timer 8, thus leading to an increase in cost and size of the computer unit, deterioration of reliability caused by a more complicated circuit configuration, and an increased burden on the software for resetting the timer 8, which causes a further increase of cost.